Remove the calls to eval() when using the `System::convertXlfToPhp(…

…)` method
contao · Aug 27, 2014 · e761e1e · e761e1e
1 parent 3474d99
commit e761e1e
Show file tree

Hide file tree

Showing 3 changed files with 39 additions and 20 deletions.
diff --git a/system/modules/core/dca/tl_settings.php b/system/modules/core/dca/tl_settings.php
@@ -596,7 +596,7 @@ public function disableModules(DataContainer $dc)
 				// Load the modules language file of disabled extensions
 				if (file_exists(TL_ROOT . '/' . $strFile . '.xlf'))
 				{
-					eval(static::convertXlfToPhp($strFile . '.xlf', $lng));
+					static::convertXlfToPhp($strFile . '.xlf', $lng, true);
 				}
 				elseif (file_exists(TL_ROOT . '/' . $strFile . '.php'))
 				{

diff --git a/system/modules/core/library/Contao/System.php b/system/modules/core/library/Contao/System.php
@@ -304,7 +304,7 @@ public static function loadLanguageFile($strName, $strLanguage=null, $blnNoCache
 
 					if (file_exists(TL_ROOT . '/' . $strFile . '.xlf'))
 					{
-						eval(static::convertXlfToPhp($strFile . '.xlf', $strCreateLang));
+						static::convertXlfToPhp($strFile . '.xlf', $strCreateLang, true);
 					}
 					elseif (file_exists(TL_ROOT . '/' . $strFile . '.php'))
 					{
@@ -628,12 +628,13 @@ protected static function readPhpFileWithoutTags($strName)
 	/**
 	 * Convert an .xlf file into a PHP language file
 	 *
-	 * @param string $strName     The name of the .xlf file
-	 * @param string $strLanguage The language code
+	 * @param string  $strName     The name of the .xlf file
+	 * @param string  $strLanguage The language code
+	 * @param boolean $blnLoad     Add the labels to the global language array
 	 *
 	 * @return string The PHP code
 	 */
-	protected static function convertXlfToPhp($strName, $strLanguage)
+	protected static function convertXlfToPhp($strName, $strLanguage, $blnLoad=false)
 	{
 		// Read the .xlf file
 		$xml = new \DOMDocument();
@@ -660,6 +661,19 @@ protected static function convertXlfToPhp($strName, $strLanguage)
 			}
 		};
 
+		// Set up the quotevalue function
+		$quotevalue = function($value)
+		{
+			if (strpos($value, '\n') !== false)
+			{
+				return '"' . str_replace('"', '\\"', $value) . '"';
+			}
+			else
+			{
+				return "'" . str_replace("'", "\\'", $value) . "'";
+			}
+		};
+
 		// Add the labels
 		foreach ($units as $unit)
 		{
@@ -678,16 +692,6 @@ protected static function convertXlfToPhp($strName, $strLanguage)
 				$value = str_replace('</ em>', '</em>', $value);
 			}
 
-			// Quote the value
-			if (strpos($value, '\n') !== false)
-			{
-				$value = '"' . str_replace('"', '\\"', $value) . '"';
-			}
-			else
-			{
-				$value = "'" . str_replace("'", "\\'", $value) . "'";
-			}
-
 			$chunks = explode('.', $unit->getAttribute('id'));
 
 			// Handle keys with dots
@@ -700,15 +704,30 @@ protected static function convertXlfToPhp($strName, $strLanguage)
 			switch (count($chunks))
 			{
 				case 2:
-					$return .= "\$GLOBALS['TL_LANG']['" . $chunks[0] . "'][" . $quotekey($chunks[1]) . "] = " . $value . ";\n";
+					$return .= "\$GLOBALS['TL_LANG']['" . $chunks[0] . "'][" . $quotekey($chunks[1]) . "] = " . $quotevalue($value) . ";\n";
+
+					if ($blnLoad)
+					{
+						$GLOBALS['TL_LANG'][$chunks[0]][$chunks[1]] = $value;
+					}
 					break;
 
 				case 3:
-					$return .= "\$GLOBALS['TL_LANG']['" . $chunks[0] . "'][" . $quotekey($chunks[1]) . "][" . $quotekey($chunks[2]) . "] = " . $value . ";\n";
+					$return .= "\$GLOBALS['TL_LANG']['" . $chunks[0] . "'][" . $quotekey($chunks[1]) . "][" . $quotekey($chunks[2]) . "] = " . $quotevalue($value) . ";\n";
+
+					if ($blnLoad)
+					{
+						$GLOBALS['TL_LANG'][$chunks[0]][$chunks[1]][$chunks[2]] = $value;
+					}
 					break;
 
 				case 4:
-					$return .= "\$GLOBALS['TL_LANG']['" . $chunks[0] . "'][" . $quotekey($chunks[1]) . "][" . $quotekey($chunks[2]) . "][" . $quotekey($chunks[3]) . "] = " . $value . ";\n";
+					$return .= "\$GLOBALS['TL_LANG']['" . $chunks[0] . "'][" . $quotekey($chunks[1]) . "][" . $quotekey($chunks[2]) . "][" . $quotekey($chunks[3]) . "] = " . $quotevalue($value) . ";\n";
+
+					if ($blnLoad)
+					{
+						$GLOBALS['TL_LANG'][$chunks[0]][$chunks[1]][$chunks[2]][$chunks[3]] = $value;
+					}
 					break;
 			}
 		}

diff --git a/system/modules/devtools/modules/ModuleLabels.php b/system/modules/devtools/modules/ModuleLabels.php
@@ -110,12 +110,12 @@ protected function compile()
 
 					// Include English file
 					$GLOBALS['TL_LANG'] = array();
-					eval(\System::convertXlfToPhp($strPath . '/' . $strFile, 'en'));
+					\System::convertXlfToPhp($strPath . '/' . $strFile, 'en', true);
 					$arrOld = $GLOBALS['TL_LANG'];
 
 					// Include foreign file
 					$GLOBALS['TL_LANG'] = array();
-					eval(\System::convertXlfToPhp($strLang . '/' . $strFile, $lng));
+					\System::convertXlfToPhp($strLang . '/' . $strFile, $lng, true);
 					$arrNew = $GLOBALS['TL_LANG'];
 
 					// Restore the former labels